CVE Catalog
CVE-2026-37007
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk0.69%
51th percentile - higher than 51% of all known CVEs
Summary
Vulnerability in the FileWriterTool component of crewai-tools <= 1.10.2rc1. A remote attacker can achieve code execution via malicious path traversal sequences in the filename argument.
Risk Assessment
An attacker can write files to arbitrary locations on the server, potentially leading to execution of malicious code and full system compromise.
Recommendation
Update crewai-tools to a patched version. Ensure file paths are properly validated and do not allow traversal outside allowed directories.
Other vulnerabilities in crewai-tools
Original NVD description (English source)
A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS